Prevent users from installing Outlook add-ins

Description

The role assignment policies applied to mailboxes do not grant the user roles that allow installing add-ins: My Custom Apps, My Marketplace Apps and My ReadWriteMailbox Apps. Add-ins the organization needs are deployed centrally by an administrator from Integrated apps in the Microsoft 365 admin center.

Rationale

Outlook add-ins run with the user's mailbox permissions; an add-in with the ReadWriteMailbox permission can read, change and send any message. Marketplace add-ins are published by third parties and a custom add-in can be side-loaded from a manifest URL sent by an attacker. Central deployment keeps the list of add-ins short, reviewed and known.

Impact

Users can no longer add add-ins themselves, including popular ones (meeting tools, CRM connectors). Ask the business which add-ins they use before the change and deploy the approved ones centrally. Add-ins already installed by users keep working until they are removed.

Audit

1. Sign in to the Exchange admin center (https://admin.exchange.microsoft.com) as at least a Global Reader.
2. Browse to Roles > User roles. For each role assignment policy (start with Default Role Assignment Policy), open Manage permissions and check that My Custom Apps, My Marketplace Apps and My ReadWriteMailbox Apps are cleared.
3. In Exchange Online PowerShell (read-only):

   Get-RoleAssignmentPolicy | Select-Object Name, IsDefault,
     @{n='AppRoles';e={($_.AssignedRoles | Where-Object { $_ -like 'My*Apps' }) -join ', '}}
   Get-EXOMailbox -ResultSize Unlimited -Properties RoleAssignmentPolicy |
     Group-Object RoleAssignmentPolicy | Select-Object Name, Count
   

4. Fail if a role assignment policy used by at least one mailbox still holds one of the three roles.

Remediation

1. Review the add-ins in use (Microsoft 365 admin center > Settings > Integrated apps) and deploy the approved ones to the relevant users or groups.
2. In the Exchange admin center, browse to Roles > User roles, open each role assignment policy in use > Manage permissions, clear My Custom Apps, My Marketplace Apps and My ReadWriteMailbox Apps, and save.
3. PowerShell equivalent (Exchange Administrator), for each policy:

   Get-ManagementRoleAssignment -RoleAssignee "Default Role Assignment Policy" |
     Where-Object { $_.Role -in 'My Custom Apps','My Marketplace Apps','My ReadWriteMailbox Apps' } |
     Remove-ManagementRoleAssignment -Confirm:$false
   

Rollback

Re-add the role to the policy: New-ManagementRoleAssignment -Policy "Default Role Assignment Policy" -Role "My Marketplace Apps".

References

• Specify the administrators and users who can install and manage add-ins for Outlook in Exchange Online Microsoft, vendor-doc, accessed 2026-10-24
• Maester MT.1041 Maester, tool, accessed 2026-10-24

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

Related controls

• related CB-M365-MAIL-008 Block additional storage providers in Outlook on the web
• related CB-M365-TENANT-015 Prevent users from adding Store apps and starting trials

People and lifecycle